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Dear Dr. Menikoff: 


On behalf of the American Association for the Advancement of Science (AAAS), we 
welcome the opportunity to comment on the Advance Notice of Proposed Rulemaking 
entitled Human Subjects Research Protections: Enhancing Protections for Research Subjects 
and Reducing Burden, Delay, and Ambiguity for Investigators. AAAS has a longstanding 
interest and expertise in research ethics, including issues related to the conduct of human 
subjects research. We support the thrust of the ANPRM, which recognizes the need for 
balancing the goals of protecting human subjects and allowing research to proceed without 
burdensome restrictions that provide little value. It is in that context that we offer the 
following comments: 


Ensuring Risk-Based Protections (Section ID) 

Questions 5, 14, 15, 17, 19 

Risk should be determined on the basis of research methods, the content of the research, and 
the characteristics of the participants. IRBs should have the flexibility needed to oversee 
research on vulnerable populations. 


The list of research activities that can qualify for expedited review, not revised since the late 
1990s, should be updated to reflect changes in research, technology, and any revisions 
forthcoming via this ANPRM. The ANPRM, however, does not include a process for such 
updating. We urge that whatever process is adopted be open and participatory, using the 
provisions of the federal Administrative Procedure Act (Public Law 79-404) applicable to the 
standard rulemaking process. 


We support eliminating limitations on the current category 2 exemption (e.g., use of 
educational tests, survey procedures, interview procedures or observation of public behavior), 
“since these studies would be conducted with competent adults and because these studies 
would now be subject to standard data security and information protection standards.” This 
list should also include safe interactive games and similar technologies. 


We agree that researchers undertaking “excused” research should register with the IRB and 
think that a brief waiting period should be in place before such research commences. During 
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this waiting period, IRBs could determine whether the research falls within the “excused” 
category. This way, the institution retains responsibility for determining whether IRB review 
is warranted. 


Audits Related to Human Subjects Research (Section II, V) 

Questions 13, 21, 22, 66 

The ANPRM suggests that audits be considered to ascertain whether the new “excused” 
category is being appropriately applied, when IRBs override the default position on 
continuing review, and to ensure compliance with an institution’s data security standards. We 
think it prudent that audits be conducted in these areas, with reports submitted to OHRP (or 
another appropriate oversight body), following the issuance of a final rule. This mechanism 
would enable OHRP to assess whether IRBs or other institutional entities are applying the 
new regulations in a consistent manner both within and among institutions. Further, tt would 
provide a roadmap for OHRP to issue further guidance and to clarify the regulations. We are 
sensitive, however, to the goal of reducing the administrative burden on institutions and on 
federal oversight agencies. Therefore, we propose that audits be most prevalent in the few 
years immediately following the adoption of the new regulations, followed by a gradual 
reduction, as appropriate. We recommend that institutions be responsible for determining 
which entities should conduct the reviews. 


Appeals to IRB Decisions (Section II) 

Question 28 

The new regulations should require institutions to adopt an appeals process, and the question 
of whether a study requires IRB approval should be one of the grounds for appeal. The 
institutions should determine the composition of the appeals entity, being careful to ensure 
that there are no significant conflicts of interest. 


Additional IRB Activities (Section II) 

Question 29 

Transparency and accountability would be furthered by requiring IRBs to identify activities 
they undertake that are not required by regulations. Moreover, greater efficiencies are likely 
to be achieved when IRBs focus on what is most critical for implementing the regulations. 


Improving the Informed Consent Process (Section IV) 

Questions 35, 37 

It is paramount that research subjects understand the research to which they are giving 
consent; thus, we strongly support the effort to encourage clearer consent forms. We 
encourage the rules to allow creative ways for researchers to convey the necessary 
information to subjects (e.g., video, slides) and to evaluate their understanding (e.g., follow- 
up questionnaires). This flexibility may be particularly important when conducting research 
with vulnerable populations. 


Consent for Future Research (Section IV, V) 

Questions 49, 52, 55 

Although it is difficult to re-identify data and biospecimens that have been de-identified, we 
are aware that it is possible, if unlikely. Therefore, we support obtaining general consent for 
further research use of personal information. However, we also are mindful that this might 
place a heavy administrative burden when data or biospecimens are collected in a clinical or 


other non-research setting, where personnel are not familiar with research issues and not 
prepared to address questions that might be raised when consent is sought for unspecified 
future research. We recommend that OHRP seek further advice on this complex subject, 
perhaps through workshops or some other mechanism where ideas can be discussed by those 
most closely involved with research of this type, as well as ethicists and others concerned 
with the protection of research subjects. We also believe the federal oversight entities should 
be aware of technological developments that could make it either easier or more difficult to 
de-identify data or biospecimens and update regulations and/or guidance as appropriate. To 
avoid an excessive administrative burden, we suggest that the new consent rules be applied 
prospectively only, grandfathering in biospecimens already collected. 


Consent policies applicable to biospecimens in the biomedical research context should not be 
automatically applied to secondary uses of social science and behavioral data. We believe 
that consent should not be required from the original sources of the data if the latter are de- 
identifiable when used for other research. We take this position for two reasons. First, there is 
a risk of impeding the development and dissemination of new research methods. The use of 
existing data sets, and those yet to come, by the research community is often the best way to 
test newly proposed statistical or other methods before they become standard practice. 
Second, it is common for university instructors to use data sets for educational purposes, 
enabling students to “play” with real data as a learning tool. We are concerned that the 
availability of such data sets may be reduced. In both instances, the chances of re-identifying 
individuals is so small and the benefits to research and education so substantial, that the 
burden imposed on researchers is outweighed by the contributions such data make to future 
research and education. 


Strengthening Data Protections (Section V) 

Questions 54, 59, 61, 63 

AAAS applauds the goal to harmonize and standardize data security. However, the idea to 
eliminate the need for IRBs to review research for information risks represents a major 
change in the current regulations, and some issues need to be more clearly addressed. 


The HIPAA administrative, physical and technical safeguards for data security reflect a 
strong approach to protecting human subjects. However, HIPAA was designed to safeguard 
protected health information, and the HIPAA Security Rule as currently written only applies 
to electronic forms of information. Hence, its adoption as the single standard for protecting 
and safeguarding information would be difficult to apply uniformly across all types of 
research studies. Much social and behavioral research is likely to be subject to the new 
security protections, and the change has particular salience for those research fields. 
Furthermore, multidisciplinary research may rely on a combination of data forms, and the 
methods used to collect and store information, as well as information risks, may differ. 


Hence, AAAS recommends that HHS carefully weigh the burden it would impose by 
applying such a uniform security standard across disparate research fields. With regard to 
social and behavioral sciences, alternative or complementary approaches to HIPAA may be 
found in the current body of literature and corresponding federal agency policies that address 
data security with the goal of minimizing information risks. We do support the idea of 
regularly evaluating the HIPAA de-identification standard to ensure it reflects evolving 
technologies and informational risks. The policy must grow with innovation. 


In general, AAAS agrees that there should be a prohibition against re-identification without 
informed consent of the individual. However, we recognize that there are unusual 
circumstances when re-identification may be necessary in order to contact individuals in the 
interest of their personal health and safety, or some public health emergency. 


Data Collection to Enhance Oversight (VI) 

We generally support the proposed changes intended to improve “the collection and analysis 
of data on unanticipated problems and adverse events.” It should be clear that the changes 
apply to the research protocol and its consequences for research subjects and others, and not 
to the broader application of research findings. Creating a single web site for reporting 
“unanticipated problems and adverse events” and harmonizing reporting requirements across 
all federal agencies would create a more efficient, and we believe safer, system for enhancing 
oversight. 


Extension of Federal Regulatory Protections (Section VII) 

We support extending the federal regulations to cover a broader sweep of human subjects 
research, as proposed in the ANPRM. However, we note that such an extension would still 
fall short of covering a source of research likely to grow in the near term. We refer to online 
health communities, such as PatientsLikeMe, which are attracting patients, and their health 
data, with increasing support from private investors and/or a for-profit business model. 
Neither federal funds nor IRB review are necessarily involved, yet such groups are 
committed to engaging in research, a reason that motivates their members in growing 
numbers to volunteer information about their health. One recent example is the community- 
based research on ALS appearing in Nature Biotechnology (29, 411-414, 2011). We 
recognize the statutory constraints on HHS to apply the regulatory protections in such cases, 
but nevertheless we use this opportunity to identify a significant gap in protecting patients 
from the risks associated with human research. 


AAAS is the world’s largest multidisciplinary science society, representing the interests of 
ten million scientists worldwide, and publisher of the prestigious peer-reviewed journal 
Science. We stand ready to assist you as you consider the vitally important questions and 
challenges that pertain to the protection of human research subjects. 


Sincerely, 
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Alan Leshħer 









